EUVD-2026-105723
GHSA-4qg3-j9gq-448c
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
DeliveryTrigger memory corruption in Scheduling
-
ExploitOverwrite memory via buffer overflow
-
ExecutionExecute arbitrary code in renderer sandbox
-
ImpactAccess in-process data / stage sandbox escape
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, buffer size validation
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a victim running Google Chrome before 156.0.8078.47 to actively load attacker-controlled HTML content (UI:R) - e.g., visiting a malicious site or a compromised/ad-served page - so some user interaction is mandatory and purely passive targets are not exploitable. No authentication is required (PR:N) and no non-default configuration is named; the bug is in the Scheduling component and reachable against standard installs. The critical LIMITING factor is that code execution is confined to the renderer sandbox (Scope:Unchanged, per description), so meaningful host compromise additionally requires chaining a separate sandbox-escape vulnerability; Chrome's default auto-update further shortens the exposure window. |
| Impact | Signals partly conflict and must be weighed carefully. The input CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, score 8.8) describes a network-reachable, low-complexity, unauthenticated flaw needing only that a victim open a crafted HTML page - the classic drive-by browser profile. However, the description and the Chromium 'Low' security-severity rating qualify this sharply: arbitrary code execution is confined 'inside the sandbox' (Scope:Unchanged), meaning a successful exploit yields control of the renderer process, not the host, unless chained with a separate sandbox-escape. This is why Google rated it Low despite the headline 8.8 - the CVSS base score does not capture Chromium's sandbox mitigation, so treat 8.8 as an over-statement of real-world impact for an isolated renderer compromise. No EPSS score, no CISA KEV listing, and no public exploit were provided, so there is no evidence of active or imminent exploitation; status is 'no public exploit identified at time of analysis.' Net: patch promptly because of ubiquitous deployment and auto-update expectations, but this is not a confirmed-exploited emergency and its practical severity is lower than the 8.8 suggests absent a chained sandbox escape. |
| Exploit ScenarioDerived | An attacker hosts or compromises a web page containing malformed content that triggers the memory-corruption bug in Chrome's Scheduling component when a victim using a pre-156.0.8078.47 build visits it. Successful exploitation lets the attacker run arbitrary code within the renderer sandbox, exposing data handled by that process and serving as a stepping stone for a further sandbox-escape chain. No public proof-of-concept was identified in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Memory corruption in Google Chrome's Scheduling component (fixed in 156.0.8078.47) lets a remote attacker who convinces a victim to open a crafted HTML page potentially achieve arbitrary code execution inside the renderer sandbox. Exploitation is not passive: it requires user interaction (UI:R) such as visiting a malicious or compromised/ad-served page, and no authentication is needed (PR:N), so any standard desktop install below the fixed build is a candidate target. Severity signals conflict - Google's Chromium rating is Low and no public exploit code or CISA KEV entry exists at time of analysis, yet the NVD-style vector scores 8.8 because of full confidentiality/integrity/availability impact within the compromised renderer; real host compromise would additionally require chaining a separate sandbox escape.
RemediationAI
Vendor-released patch: upgrade Google Chrome to 156.0.8078.47 or later - normally delivered automatically by Chrome's built-in updater, but verify via chrome://version and force an update/relaunch where auto-update is disabled, and push the fixed build through enterprise patch management using the Stable channel release notes (https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html). Because the bug is only reachable by loading attacker-controlled HTML, interim compensating controls are: keep Chrome's default Site Isolation enabled (do not disable it for performance - it is the main barrier between renderer code execution and cross-site data, and disabling it materially widens blast radius); restrict or block browsing to untrusted/uncategorized sites via enterprise URL filtering or a proxy (trade-off: false positives and reduced user productivity); and where policy allows, run high-risk browsing in a disposable VM or remote-isolated browser session (trade-off: overhead and reduced usability). Note that since execution is sandbox-confined, endpoint detection should focus on renderer-to-broker IPC anomalies and sandbox-escape attempts rather than on the initial memory corruption; no vendor workaround short of updating removes the underlying flaw.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a CWE-119 improper-restriction-of-operations-within-a-memory-buffer (classic out-of-bounds read/write style memory corruption) reachable through the Scheduling subsystem that Chrome uses to coordinate task and frame scheduling in the renderer. Parsing attacker-controlled HTML/script drives the scheduler into a state where buffer bounds are not respected, corrupting memory in the renderer process. Because the CVSS vector has Scope:Unchanged and the description explicitly frames the outcome as code execution 'inside the sandbox', the primitive is confined to the renderer's sandboxed address space - meaningful escalation to the host, to persisted data outside the sandbox, or to other origins requires a second, independent sandbox-escape or IPC-confusion bug. The access vector is network with low attack complexity and no privileges, but user interaction is mandatory: the victim must load the crafted page in a Chrome build older than 156.0.8078.47. No CPE strings were supplied in the intelligence feed; the authoritative affected-version data is the EUVD entry listing Chrome builds below 156.0.8078.47, which corresponds to the Stable channel update described in the referenced Chrome Releases blog post and the associated Chromium issue tracker entry (issues.chromium.org/540068924).
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Network drive-by via crafted page with no auth gives AV:N/AC:L/PR:N/UI:R; code execution within the renderer yields high C/I/A but S:U since impact stays inside the sandbox.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Memory corruption in Scheduling in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)
Executive ViewAI
Google Chrome builds prior to 156.0.8078.47 carry a high-severity memory-corruption flaw in the Scheduling component that could allow code execution inside the browser's renderer sandbox if a user visits a crafted page. The exposure is concentrated in unpatched desktop browser fleets and depends on user browsing behavior rather than server-side compromise, so leadership should focus on endpoint patch compliance. No public exploit has been identified at time of analysis, but the broad install base and low attack complexity make prompt update enforcement the primary risk control.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Exploit-DB